termdock 1.4.168 → 1.4.170

package/dist/server/utils/apiAccess.js

@@ -0,0 +1,27 @@
+import crypto from 'crypto';
+import { requireAuth } from './authProtection.js';
+export function isTrustedLocalRequest(req, token) {
+    const supplied = req.header('X-Termdock-Local-Token');
+    if (!token || !supplied || req.headers.origin || req.headers['sec-fetch-site'])
+        return false;
+    const address = req.socket.remoteAddress ?? '';
+    if (!['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address))
+        return false;
+    const a = Buffer.from(token);
+    const b = Buffer.from(supplied);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+/** Mounted at /api BEFORE body parsing. New endpoints are private by default. */
+export function apiAccessGate(localToken) {
+    return requireAuth({ bypass: (req) => {
+            const path = req.path.toLowerCase().replace(/\/$/, '');
+            if (['GET', 'HEAD'].includes(req.method) && ['/auth/status', '/meta'].includes(path))
+                return true;
+            if (req.method === 'POST' && ['/auth/login', '/auth/logout'].includes(path))
+                return true;
+            // Preview capabilities perform scoped, session-bound authentication themselves.
+            if (['GET', 'HEAD'].includes(req.method) && /^\/terminal\/fs\/preview\//.test(path))
+                return true;
+            return isTrustedLocalRequest(req, localToken) && (/^\/(?:terminal|local)(?:\/|$)/.test(path) || path === '/diagnostics/runtime');
+        } });
+}

package/dist/server/utils/apiCachePolicy.js

@@ -0,0 +1,10 @@
+const VALIDATED_PREVIEWS = new Set(['/terminal/fs/read', '/terminal/fs/blob', '/terminal/fs/eda-preview']);
+/** Ordinary JSON callers require bodies. Preview callers explicitly handle 304. */
+export const apiCachePolicy = (req, res, next) => {
+    if (!VALIDATED_PREVIEWS.has(req.path)) {
+        delete req.headers['if-none-match'];
+        delete req.headers['if-modified-since'];
+        res.setHeader('Cache-Control', 'no-store');
+    }
+    next();
+};

package/dist/server/utils/authProtection.js

@@ -1,11 +1,12 @@
 import crypto from 'crypto';
+import { EventEmitter } from 'events';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import { getCookieSecurityOptions } from './cookieSecurity.js';
 // Auth state lives under ~/.termdock/. We keep two separate files:
 //   - auth.json:          password hash (mode 0600). Presence enables auth.
-//   - auth-sessions.json: active session tokens (mode 0600). Persisted so
+//   - auth-sessions.json: active session token hashes (mode 0600). Persisted so
 //                         clients survive a server restart without re-login.
 const AUTH_DIR = path.join(os.homedir(), '.termdock');
 const AUTH_FILE = path.join(AUTH_DIR, 'auth.json');
@@ -13,7 +14,7 @@ const SESSIONS_FILE = path.join(AUTH_DIR, 'auth-sessions.json');
 // Cookie holding the opaque session token. httpOnly + sameSite=lax. The token
 // itself is 32 random bytes hex; never derived from the password.
 export const AUTH_COOKIE = 'termdock-auth';
-const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 // scrypt parameters. N=2^15 keeps interactive login latency acceptable on
 // laptops/phones while still being painful for offline brute force on a
 // single secret.
@@ -22,7 +23,9 @@ const SCRYPT_R = 8;
 const SCRYPT_P = 1;
 const SCRYPT_KEY_LEN = 64;
 const SCRYPT_SALT_LEN = 16;
-// In-memory cache of active sessions, keyed by token. Mirrors SESSIONS_FILE.
+// In-memory cache of active sessions, keyed by SHA-256 token hash.
+export const authEvents = new EventEmitter();
+authEvents.setMaxListeners(0);
 const sessions = new Map();
 let sessionsLoaded = false;
 const loginAttempts = new Map();
@@ -33,7 +36,14 @@ function ensureAuthDir() {
 }
 function writeFileSecure(filePath, content) {
     ensureAuthDir();
-    fs.writeFileSync(filePath, content, { encoding: 'utf-8', mode: 0o600 });
+    const temporary = `${filePath}.${crypto.randomBytes(8).toString('hex')}.tmp`;
+    try {
+        fs.writeFileSync(temporary, content, { encoding: 'utf-8', mode: 0o600, flag: 'wx' });
+        fs.renameSync(temporary, filePath);
+    }
+    finally {
+        fs.rmSync(temporary, { force: true });
+    }
     // Best-effort chmod in case the file already existed with looser perms.
     try {
         fs.chmodSync(filePath, 0o600);
@@ -105,6 +115,11 @@ function getEnvPasswordHash() {
     }
     return cachedEnvHash.hash;
 }
+function credentialFingerprint() {
+    const password = getEnvPassword();
+    const source = password ? `env:${getEnvPasswordHash()}` : `file:${readAuthFile()?.passwordHash ?? 'disabled'}`;
+    return crypto.createHash('sha256').update(source).digest('hex');
+}
 export function isEnvPasswordSet() {
     return getEnvPassword() !== null;
 }
@@ -112,10 +127,13 @@ export function isAuthEnabled() {
     if (getEnvPassword())
         return true;
     try {
-        return fs.existsSync(AUTH_FILE);
+        fs.statSync(AUTH_FILE);
+        return true;
     }
-    catch {
-        return false;
+    catch (error) {
+        // Only a missing file disables auth. I/O and permission failures must not
+        // turn an authenticated terminal into an anonymous one.
+        return error.code !== 'ENOENT';
     }
 }
 export function readAuthFile() {
@@ -124,11 +142,13 @@ export function readAuthFile() {
             return null;
         const raw = fs.readFileSync(AUTH_FILE, 'utf-8');
         const parsed = JSON.parse(raw);
-        if (parsed.version !== 1 || typeof parsed.passwordHash !== 'string')
+        if (parsed.version !== 1 || typeof parsed.passwordHash !== 'string' ||
+            !/^scrypt\$[0-9a-f]{32}\$[0-9a-f]{128}$/.test(parsed.passwordHash))
             return null;
         return {
             version: 1,
             passwordHash: parsed.passwordHash,
+            passwordLength: typeof parsed.passwordLength === 'number' ? parsed.passwordLength : undefined,
             createdAt: typeof parsed.createdAt === 'number' ? parsed.createdAt : Date.now(),
         };
     }
@@ -136,8 +156,8 @@ export function readAuthFile() {
         return null;
     }
 }
-export function writeAuthFile(passwordHash) {
-    const payload = { version: 1, passwordHash, createdAt: Date.now() };
+export function writeAuthFile(passwordHash, passwordLength) {
+    const payload = { version: 1, passwordHash, createdAt: Date.now(), passwordLength };
     writeFileSecure(AUTH_FILE, JSON.stringify(payload, null, 2));
 }
 export function clearAuthFile() {
@@ -147,8 +167,10 @@ export function clearAuthFile() {
     }
     catch { /* ignore */ }
     // Clearing the password also invalidates all existing sessions.
+    sessionsLoaded = true;
     sessions.clear();
     persistSessions();
+    authEvents.emit('revoked');
 }
 function loadSessionsIfNeeded() {
     if (sessionsLoaded)
@@ -159,14 +181,17 @@ function loadSessionsIfNeeded() {
             return;
         const raw = fs.readFileSync(SESSIONS_FILE, 'utf-8');
         const parsed = JSON.parse(raw);
-        if (parsed.version !== 1 || !Array.isArray(parsed.sessions))
+        if (parsed.version !== 2 || !Array.isArray(parsed.sessions))
             return;
         const now = Date.now();
         for (const record of parsed.sessions) {
             if (record &&
                 typeof record.token === 'string' &&
+                /^[0-9a-f]{64}$/.test(record.token) &&
+                record.credential === credentialFingerprint() &&
                 typeof record.expiresAt === 'number' &&
                 typeof record.createdAt === 'number' &&
+                typeof record.lastUsedAt === 'number' &&
                 record.expiresAt > now) {
                 sessions.set(record.token, record);
             }
@@ -174,20 +199,11 @@ function loadSessionsIfNeeded() {
     }
     catch { /* ignore */ }
 }
-let persistTimer = null;
 function persistSessions() {
-    if (persistTimer)
-        clearTimeout(persistTimer);
-    persistTimer = setTimeout(() => {
-        try {
-            const payload = {
-                version: 1,
-                sessions: Array.from(sessions.values()),
-            };
-            writeFileSecure(SESSIONS_FILE, JSON.stringify(payload, null, 2));
-        }
-        catch { /* ignore */ }
-    }, 200);
+    // Revocations must reach disk before logout succeeds; a debounce could
+    // resurrect the session if the server restarts immediately after logout.
+    const payload = { version: 2, sessions: Array.from(sessions.values()) };
+    writeFileSecure(SESSIONS_FILE, JSON.stringify(payload, null, 2));
 }
 function pruneExpiredSessions() {
     loadSessionsIfNeeded();
@@ -203,42 +219,65 @@ function pruneExpiredSessions() {
         persistSessions();
 }
 export function createSession() {
-    loadSessionsIfNeeded();
+    pruneExpiredSessions();
+    if (sessions.size >= 100) {
+        sessions.delete(sessions.keys().next().value);
+        authEvents.emit('revoked');
+    }
     const token = crypto.randomBytes(32).toString('hex');
     const now = Date.now();
     const record = {
         token,
         createdAt: now,
         expiresAt: now + SESSION_TTL_MS,
+        lastUsedAt: now,
+        credential: credentialFingerprint(),
     };
-    sessions.set(token, record);
+    const tokenHash = crypto.createHash('sha256').update(token).digest('hex');
+    sessions.set(tokenHash, { ...record, token: tokenHash });
     persistSessions();
     return record;
 }
-export function isSessionValid(token) {
+export function isSessionValid(token, touch = false) {
     if (!token || typeof token !== 'string')
         return false;
     loadSessionsIfNeeded();
-    const record = sessions.get(token);
+    const tokenHash = crypto.createHash('sha256').update(token).digest('hex');
+    const record = sessions.get(tokenHash);
     if (!record)
         return false;
-    if (record.expiresAt <= Date.now()) {
-        sessions.delete(token);
+    if (record.expiresAt <= Date.now() ||
+        record.credential !== credentialFingerprint()) {
+        sessions.delete(tokenHash);
         persistSessions();
         return false;
     }
+    if (touch) {
+        const now = Date.now();
+        // Coalesce subsecond HTTP/input bursts, while persisting every new visit
+        // before replying. Also immediately upgrade still-valid shorter sessions.
+        if (now - record.lastUsedAt >= 1000 || record.expiresAt - record.lastUsedAt < SESSION_TTL_MS) {
+            record.lastUsedAt = now;
+            record.expiresAt = now + SESSION_TTL_MS;
+            persistSessions();
+        }
+    }
     return true;
 }
 export function destroySession(token) {
     if (!token)
         return;
     loadSessionsIfNeeded();
-    if (sessions.delete(token))
+    if (sessions.delete(crypto.createHash('sha256').update(token).digest('hex'))) {
         persistSessions();
+        authEvents.emit('revoked');
+    }
 }
 export function destroyAllSessions() {
+    sessionsLoaded = true;
     sessions.clear();
     persistSessions();
+    authEvents.emit('revoked');
 }
 // ── Login rate limiting ──
 // Exponential backoff per source IP: 0, 0, 0, 1s, 4s, 16s, 64s, 256s, capped.
@@ -248,6 +287,10 @@ const BACKOFF_BASE_MS = 1000;
 const BACKOFF_CAP_MS = 15 * 60 * 1000; // 15 min hard cap per attempt window
 export function getLoginBlockMs(ip) {
     const record = loginAttempts.get(ip);
+    if (record && Date.now() - record.updatedAt > BACKOFF_CAP_MS * 2) {
+        loginAttempts.delete(ip);
+        return 0;
+    }
     if (!record)
         return 0;
     const remaining = record.blockedUntil - Date.now();
@@ -255,8 +298,12 @@ export function getLoginBlockMs(ip) {
 }
 export function recordLoginFailure(ip) {
     const now = Date.now();
-    const record = loginAttempts.get(ip) ?? { failures: 0, blockedUntil: 0 };
+    const record = loginAttempts.get(ip) ?? { failures: 0, blockedUntil: 0, updatedAt: now };
+    record.updatedAt = now;
     record.failures += 1;
+    if (loginAttempts.size >= 4096 && !loginAttempts.has(ip)) {
+        loginAttempts.delete(loginAttempts.keys().next().value);
+    }
     if (record.failures > BACKOFF_GRACE_FAILURES) {
         const exponent = record.failures - BACKOFF_GRACE_FAILURES - 1;
         const delay = Math.min(BACKOFF_CAP_MS, BACKOFF_BASE_MS * Math.pow(4, exponent));
@@ -274,6 +321,18 @@ export function isRequestAuthenticated(req) {
     const token = req.cookies?.[AUTH_COOKIE];
     return isSessionValid(typeof token === 'string' ? token : undefined);
 }
+// Refresh both sides of the login on HTTP visits. Socket validation alone
+// cannot update a browser cookie, so the UI also checks status on foregrounding.
+export function renewSessionMiddleware(req, res, next) {
+    const token = req.cookies?.[AUTH_COOKIE];
+    const authMutation = /^\/(?:api\/)?auth\/(?:login|logout)\/?$/i.test(req.path);
+    if (!authMutation && isAuthEnabled() && typeof token === 'string' && isSessionValid(token, true)) {
+        const key = crypto.createHash('sha256').update(token).digest('hex');
+        const record = sessions.get(key);
+        setSessionCookie(res, token, record.expiresAt);
+    }
+    next();
+}
 // Middleware factory: blocks the request with 401 unless either auth is
 // disabled (no auth.json) or the request carries a valid session cookie.
 // Bypass paths are public (login/status/health/static).
@@ -290,7 +349,7 @@ export function requireAuth(options) {
 }
 // Verify the cookie attached to a WebSocket upgrade request. Reads the raw
 // Cookie header and matches AUTH_COOKIE without depending on Express middleware.
-export function isUpgradeRequestAuthenticated(cookieHeader) {
+export function isUpgradeRequestAuthenticated(cookieHeader, touch = false) {
     if (!isAuthEnabled())
         return true;
     if (!cookieHeader)
@@ -303,9 +362,13 @@ export function isUpgradeRequestAuthenticated(cookieHeader) {
         const name = pair.slice(0, idx).trim();
         if (name !== AUTH_COOKIE)
             continue;
-        const value = decodeURIComponent(pair.slice(idx + 1).trim());
-        if (isSessionValid(value))
-            return true;
+        try {
+            const value = decodeURIComponent(pair.slice(idx + 1).trim());
+            return isSessionValid(value, touch);
+        }
+        catch {
+            return false;
+        }
     }
     return false;
 }
@@ -315,11 +378,11 @@ export function getClientIp(req) {
     // sees the proxy IP — that's an acceptable trade-off here.
     return req.socket.remoteAddress ?? 'unknown';
 }
-export function setSessionCookie(res, token) {
+export function setSessionCookie(res, token, expiresAt = Date.now() + SESSION_TTL_MS) {
     res.cookie(AUTH_COOKIE, token, {
         httpOnly: true,
         ...getCookieSecurityOptions(),
-        maxAge: SESSION_TTL_MS,
+        maxAge: Math.max(0, expiresAt - Date.now()),
         path: '/',
     });
 }
@@ -338,3 +401,42 @@ export function verifyPassword(password) {
         return false;
     return verifyPasswordAgainstHash(password, auth.passwordHash);
 }
+// A bounded asynchronous KDF prevents login traffic from blocking terminal I/O
+// or filling the libuv worker queue. The shared budget also covers rotating IPs.
+let activeVerifications = 0;
+let verificationWindow = 0;
+let verificationCount = 0;
+export async function verifyPasswordAsync(password) {
+    const now = Date.now();
+    if (now - verificationWindow >= 60_000) {
+        verificationWindow = now;
+        verificationCount = 0;
+    }
+    if (activeVerifications >= 2 || verificationCount >= 30)
+        return null;
+    if (!password || Buffer.byteLength(password) > 1024)
+        return false;
+    verificationCount++;
+    const stored = getEnvPasswordHash() ?? readAuthFile()?.passwordHash;
+    if (!stored)
+        return false;
+    const [algorithm, salt, hash] = stored.split('$');
+    if (algorithm !== 'scrypt' || !/^[0-9a-f]{32}$/.test(salt ?? '') || !/^[0-9a-f]{128}$/.test(hash ?? ''))
+        return false;
+    const credential = credentialFingerprint();
+    activeVerifications++;
+    try {
+        const derived = await new Promise((resolve, reject) => {
+            crypto.scrypt(password, Buffer.from(salt, 'hex'), SCRYPT_KEY_LEN, {
+                N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P, maxmem: 128 * SCRYPT_N * SCRYPT_R * 2,
+            }, (error, key) => error ? reject(error) : resolve(key));
+        });
+        return credential === credentialFingerprint() && crypto.timingSafeEqual(derived, Buffer.from(hash, 'hex'));
+    }
+    catch {
+        return false;
+    }
+    finally {
+        activeVerifications--;
+    }
+}

package/dist/server/utils/cookieSecurity.js

@@ -1,13 +1,14 @@
+import { getPublicOrigin } from './publicSecurity.js';
 let secureCookies = false;
 export function setSecureCookieMode(enabled) {
     secureCookies = enabled;
 }
 export function shouldUseSecureCookies() {
-    return secureCookies;
+    return secureCookies || Boolean(getPublicOrigin());
 }
 export function getCookieSecurityOptions() {
     return {
-        secure: secureCookies,
+        secure: shouldUseSecureCookies(),
         sameSite: 'lax',
     };
 }

package/dist/server/utils/csrfProtection.js

@@ -29,7 +29,8 @@ export class CsrfProtection {
      * 验证CSRF令牌
      */
     verifyToken(cookieToken, headerToken) {
-        if (typeof cookieToken !== 'string' || typeof headerToken !== 'string') {
+        if (typeof cookieToken !== 'string' || typeof headerToken !== 'string' ||
+            !new RegExp(`^[0-9a-f]{${this.config.tokenLength * 2}}$`).test(cookieToken) || cookieToken.length !== headerToken.length) {
             return false;
         }
         const cookieBuffer = Buffer.from(cookieToken);
@@ -72,11 +73,6 @@ export class CsrfProtection {
             if (safeMethods.includes(req.method)) {
                 return next();
             }
-            // 跳过某些端点（如果需要）
-            const skipPaths = ['/api/csrf-token'];
-            if (skipPaths.some(path => req.path.startsWith(path))) {
-                return next();
-            }
             // 获取令牌
             const cookieToken = req.cookies?.[this.config.cookieName];
             const headerToken = req.headers[this.config.headerName.toLowerCase()];

package/dist/server/utils/previewValidation.js

@@ -0,0 +1,16 @@
+import crypto from 'node:crypto';
+import { requestAcceptsEtag } from './edaPreviewCache.js';
+/** Call only after authentication, path validation and file-type/size checks. */
+export function validatePreview(req, res, file, stat, representation) {
+    const revision = crypto.createHash('sha256')
+        .update(JSON.stringify([file, stat.size, stat.mtimeMs, stat.ctimeMs, representation]))
+        .digest('base64url').slice(0, 24);
+    const etag = `W/"preview-${revision}"`;
+    res.setHeader('ETag', etag);
+    res.setHeader('Last-Modified', stat.mtime.toUTCString());
+    res.setHeader('Cache-Control', 'private, no-cache');
+    if (!requestAcceptsEtag(req.headers['if-none-match'], etag))
+        return false;
+    res.status(304).end();
+    return true;
+}

package/dist/server/utils/publicSecurity.js

@@ -0,0 +1,44 @@
+import { isAuthEnabled, readAuthFile } from './authProtection.js';
+/** Explicit external origin; never infer TLS or trust from forwarded headers. */
+export function getPublicOrigin() {
+    const raw = process.env.TERMDOCK_PUBLIC_ORIGIN;
+    if (!raw)
+        return null;
+    const url = new URL(raw);
+    if (url.protocol !== 'https:' || url.username || url.password || url.pathname !== '/' || url.search || url.hash) {
+        throw new Error('TERMDOCK_PUBLIC_ORIGIN must be an HTTPS origin, e.g. https://term.example.com');
+    }
+    return url.origin;
+}
+export function assertPublicSecurity() {
+    if (!getPublicOrigin())
+        return;
+    if (!isAuthEnabled() || (!process.env.TERMDOCK_PASSWORD && !readAuthFile())) {
+        throw new Error('Public access requires authentication. Run td --set-password before starting.');
+    }
+    if (!process.env.TERMDOCK_PASSWORD && (readAuthFile()?.passwordLength ?? 0) < 16) {
+        throw new Error('Public access requires a verified 16-character password. Run td --set-password again.');
+    }
+    if (process.env.TERMDOCK_PASSWORD && process.env.TERMDOCK_PASSWORD.length < 16) {
+        throw new Error('Public access requires TERMDOCK_PASSWORD to contain at least 16 characters.');
+    }
+}
+export const securityHeaders = (req, res, next) => {
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Referrer-Policy', 'no-referrer');
+    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+    // Enforce sandbox even for top-level navigation to user-controlled HTML/SVG.
+    // allow-same-origin must NEVER be added: that would expose the terminal API.
+    const preview = /^\/api\/terminal\/fs(?:\/|$)/i.test(req.path);
+    res.setHeader('Content-Security-Policy', preview
+        ? "sandbox allow-scripts; frame-ancestors 'self'; object-src 'none'; base-uri 'self'"
+        : "script-src 'self' 'wasm-unsafe-eval'; script-src-attr 'none'; worker-src 'self' blob:; frame-ancestors 'self'; object-src 'none'; base-uri 'self'");
+    if (getPublicOrigin()) {
+        res.setHeader('Strict-Transport-Security', 'max-age=31536000');
+        if (!isAuthEnabled()) {
+            res.status(503).json({ error: 'Public access requires authentication', code: 'PUBLIC_AUTH_REQUIRED' });
+            return;
+        }
+    }
+    next();
+};

package/dist/server/utils/requestDeadline.js

@@ -20,6 +20,8 @@ const DEADLINE_RULES = [
     // 有限但可能很久：大目录搜索（有 done 事件的进度流）、大文件下载。
     { method: 'GET', pattern: /^\/api\/terminal\/fs\/search$/, deadlineMs: 120_000 },
     { method: 'GET', pattern: /^\/api\/terminal\/fs\/download$/, deadlineMs: 300_000 },
+    // KiCad GLB responses can take longer than rendering to transfer to a phone.
+    { method: 'GET', pattern: /^\/api\/terminal\/fs\/eda-preview$/, deadlineMs: 120_000 },
     // 上传最多 100MB×50 文件，弱网下接收请求体可能要几分钟。注意 Node 内置
     // requestTimeout（默认 300s，本项目未改）管「请求体接收」阶段并在超时后
     // 回 408，所以这里必须低于 300s——让我们的 503+日志先出手，而不是被

package/dist/server/utils/requestSecurity.js

@@ -1,3 +1,5 @@
+import { shouldUseSecureCookies } from './cookieSecurity.js';
+import { getPublicOrigin } from './publicSecurity.js';
 import { getLanIPv4Addresses, localAccessManager } from './localAccess.js';
 const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
 function stripPort(hostHeader) {
@@ -39,6 +41,9 @@ export function getAllowedHosts() {
     for (const host of getEnvExtraHosts()) {
         hosts.add(host);
     }
+    const publicOrigin = getPublicOrigin();
+    if (publicOrigin)
+        hosts.add(new URL(publicOrigin).hostname);
     return hosts;
 }
 export function isAllowedHost(hostHeader) {
@@ -55,20 +60,25 @@ export function validateHostMiddleware(req, res, next) {
     next();
 }
 export function isAllowedOrigin(originHeader, _hostHeader) {
-    // 与下方 isUpgradeOriginAllowed 同理：dev 模式下 Vite proxy (9833 → 9835) 用
-    // changeOrigin: true 把 Host 改写成 `localhost:9835`，而浏览器 Origin 仍是
-    // `http://192.168.x.x:9833`，强制 Origin === Host 会让 LAN 访问的所有 POST
-    // （包括登录）全部 403。Origin 头由浏览器控制、无法被网页攻击者伪造，所以只
-    // 要求 origin host 落在 allowedHosts 白名单内即可，防 CSRF 的强度不变。
-    // 注意：反向代理场景下 Host 头可能是内部地址，不用它来 gate Origin 检查，
-    // 否则 TERMDOCK_ALLOWED_HOSTS 只包含公网域名时会误杀正常登录请求。
+    // Non-browser API clients may omit Origin; cookie-authenticated mutations
+    // additionally require CSRF tokens. Browsers cannot forge this header.
     if (!originHeader)
         return true;
     try {
-        const originHost = stripPort(new URL(originHeader).host);
-        if (!originHost)
+        const origin = new URL(originHeader);
+        if (!['http:', 'https:'].includes(origin.protocol) || origin.origin !== originHeader)
             return false;
-        return getAllowedHosts().has(originHost);
+        const publicOrigin = getPublicOrigin();
+        if (publicOrigin)
+            return origin.origin === publicOrigin;
+        if (!getAllowedHosts().has(stripPort(origin.host)))
+            return false;
+        // Only the development proxy intentionally changes Host/port. On normal
+        // listeners, another service on the same LAN host is a different origin.
+        if (process.env.NODE_ENV === 'development')
+            return true;
+        return origin.host.toLowerCase() === (_hostHeader ?? '').toLowerCase() &&
+            origin.protocol === (shouldUseSecureCookies() ? 'https:' : 'http:');
     }
     catch {
         return false;
@@ -81,23 +91,8 @@ export function validateOriginMiddleware(req, res, next) {
     }
     next();
 }
-export function isUpgradeOriginAllowed(originHeader, _hostHeader) {
-    // WS 升级请求：Origin 头是浏览器实际发出的（不可伪造），而 Host 头可能被前置代理改写。
-    // 在 dev 模式下 Vite proxy (9833 → 9835) 用 changeOrigin: true 会把 Host 改写成
-    // `localhost:9835`，但 Origin 仍是 `http://192.168.x.x:9833`。这种 mismatch
-    // 会让正常 LAN 访问全部 403、WS 退化为持续 reconnecting。
-    // 这里只要求 origin host 落在 allowedHosts 里（loopback + LAN IPv4 + mDNS 域名），
-    // 不强制等于 request.headers.host。Origin 校验保持原强度（必须能解析出 host、
-    // 且 host 在白名单内），所以攻击者把 Origin 改成任意地址仍然过不了。
-    if (!originHeader)
-        return true;
-    try {
-        const originHost = stripPort(new URL(originHeader).host);
-        if (!originHost)
-            return false;
-        return getAllowedHosts().has(originHost);
-    }
-    catch {
+export function isUpgradeOriginAllowed(originHeader, hostHeader) {
+    if (getPublicOrigin() && !originHeader)
         return false;
-    }
+    return isAllowedOrigin(originHeader, hostHeader);
 }